# APT29 Watering-Hole Campaign Against Mongolian Government Sites Using iOS WebKit and Chrome Android Exploits (CVE-2023-41993, CVE-2024-5274, CVE-2024-4671)

> Google TAG attributes (moderate confidence) to Russian government-backed APT29 watering-hole attacks on Mongolian government websites between November 2023 and July 2024. The attacks delivered n-day exploits against iOS 16.6.1 and older and Chrome on Android (m121-m123) to steal browser cookies and credentials. TAG states the exploits were identical or strikingly similar to those previously used as zero-days by commercial surveillance vendors Intellexa and NSO Group.

- **Published:** 2026-11-05T20:03:57Z
- **Last reviewed:** 2026-11-05T20:03:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5340
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5340.png
- **ID:** TL-2026-5340
- **Severity:** HIGH (CVSS 9.6)
- **Category:** APT
- **Status:** MONITORING
- **Actor:** APT29 (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)
- **CVEs:** CVE-2023-41993, CVE-2024-5274, CVE-2024-4671

## Description

Between November 2023 and July 2024, Google's Threat Analysis Group (TAG) observed multiple watering-hole campaigns delivered from compromised Mongolian government websites, including the Cabinet (cabinet.gov.mn) and Ministry of Foreign Affairs (mfa.gov.mn); BleepingComputer additionally lists mga.gov.mn. Malicious iframes injected into the sites loaded attacker-controlled content from track-adv.com and ceo-adviser.com. TAG assesses with moderate confidence that the activity is attributable to APT29 (Midnight Blizzard / Cozy Bear), partly because the iOS cookie-stealer framework matches one used in a March 2021 Russian government-backed campaign that exploited CVE-2021-1879 against Western European officials.

The iOS campaigns (November 2023 and February 2024) targeted iOS 16.6.1 and older using CVE-2023-41993, a WebKit flaw patched in iOS 16.7 and previously exploited as a zero-day by Intellexa in September 2023. TAG reports the exploit used the exact same trigger as Intellexa's. A reconnaissance payload (VALIDVICTOR) profiled the device (canvas fingerprinting for iPhone model, screen size, CPU count, GPU, User-Agent and client hints, per-session identifiers), followed by a cookie stealer (COOKIESNATCH) that targeted 14 hardcoded domains including Gmail, Microsoft, LinkedIn, Yahoo, Facebook, GitHub and iCloud, using WebSocket manipulation by traversing pointer sets, and exfiltrated cookies to attacker servers. Lockdown Mode users were protected.

The July 2024 Android campaign targeted Chrome m121-m123 and chained CVE-2024-5274 (V8 type confusion; a slightly modified version of the exploit NSO Group used as a zero-day in May 2024) with CVE-2024-4671 (Visuals use-after-free sandbox escape; similar to prior Intellexa exploits). After the sandbox escape, the ANDROSNATCH payload deleted Chrome crash reports, exfiltrated Chrome databases (cookies, passwords, account data, history, trust tokens), and was delivered via LD_PRELOAD injection of /data/data/com.android.chrome/c.so. A Chrome reconnaissance payload profiled victims first. Chrome Site Isolation meant the renderer exploit alone was insufficient, requiring the sandbox escape.

All three vulnerabilities were patched before the campaigns used them (n-day exploitation), but remained effective against unpatched devices. TAG notes that the origin of the exploit code is unknown; possible routes discussed in coverage include compromise of vendor networks, insiders, direct collaboration or purchase from brokers, none confirmed. Mitigations: patch iOS and Chrome, enable iOS Lockdown Mode, and use Safe Browsing (updated with the identified domains).

## MITRE ATT&CK

- T1583.001 Domains
- T1659 Content Injection
- T1592 Gather Victim Host Information
- T1203 Exploitation for Client Execution
- T1574.006 Dynamic Linker Hijacking
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**APT29 Mongolia Watering Hole — Contact with track-adv.com / ceo-adviser.com Exploit Infrastructure** (`TL-2026-5340-SPL-001`)

Detects web-proxy/web-datamodel traffic to track-adv.com and ceo-adviser.com, the attacker-controlled domains that received traffic from malicious iframes injected into compromised Mongolian government sites (cabinet.gov.mn, mfa.gov.mn, mga.gov.mn) and served the iOS WebKit (CVE-2023-41993) and Chrome Android (CVE-2024-5274 + CVE-2024-4671) exploit chains attributed by Google TAG to APT29. Hits on the known stager/stealer endpoints (market-analytics.php, analytics.php?personalization_id, fb-connect.php) are escalated as likely exploit delivery or cookie theft (VALIDVICTOR / COOKIESNATCH / ANDROSNATCH).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1189, T1659, T1583.001, T1203
- **Data sources:** splunk_cim_web_datamodel, web_proxy_logs, DeviceNetworkEvents, CommonSecurityLog
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
| tstats summariesonly=false count min(_time) as firstTime max(_time) as lastTime values(Web.url) as urls values(Web.http_user_agent) as user_agents from datamodel=Web.Web where (Web.url="*track-adv.com*" OR Web.url="*ceo-adviser.com*" OR Web.dest="track-adv.com" OR Web.dest="ceo-adviser.com") by Web.src Web.user Web.dest
| rename Web.* as *
| eval stage=if(match(mvjoin(urls,"|"),"(?i)market-analytics[.]php|personalization_id|fb-connect[.]php"),"exploit_or_stealer_endpoint","attacker_domain_contact")
| eval firstTime=strftime(firstTime,"%F %T"), lastTime=strftime(lastTime,"%F %T")
| table firstTime lastTime src user dest stage count urls user_agents
```

### Microsoft KQL

```kql
let attackerDomains = dynamic(["track-adv.com","ceo-adviser.com"]);
union
(DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any (attackerDomains)
    | project TimeGenerated = Timestamp, Source = "DeviceNetworkEvents", Device = DeviceName, User = InitiatingProcessAccountUpn, Process = InitiatingProcessFileName, Url = RemoteUrl, RemoteIP),
(CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where RequestURL has_any (attackerDomains) or DestinationHostName has_any (attackerDomains)
    | project TimeGenerated, Source = "CommonSecurityLog", Device = SourceIP, User = SourceUserName, Process = RequestClientApplication, Url = RequestURL, RemoteIP = DestinationIP)
| sort by TimeGenerated desc
```

### Sigma

```yaml
title: APT29 Mongolia Watering Hole - Proxy Contact With track-adv.com or ceo-adviser.com
id: 3f1a7c52-8d4e-4b19-a6c3-5e2b9d7f0a11
status: experimental
description: Detects proxy traffic to track-adv.com and ceo-adviser.com, attacker domains used in the 2023-2024 APT29 watering-hole campaign against Mongolian government sites (CVE-2023-41993, CVE-2024-5274, CVE-2024-4671).
references:
    - https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/
    - https://attack.mitre.org/groups/G0016/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.initial-access
    - attack.t1189
    - attack.t1659
    - attack.resource-development
    - attack.t1583.001
    - attack.execution
    - attack.t1203
    - attack.g0016
    - cve.2023-41993
    - cve.2024-5274
    - cve.2024-4671
logsource:
    category: proxy
detection:
    selection:
        cs-host|endswith:
            - 'track-adv.com'
            - 'ceo-adviser.com'
    condition: selection
falsepositives:
    - Security researchers or threat-intel teams deliberately browsing the indicator domains (sandbox egress)
level: high

```

**Known false positives:**

- Threat-intel analysts or sandboxes that intentionally resolve and fetch the indicator domains
- Security tooling replaying published IOC lists against the proxy

**Tuning notes:** Ensure the proxy sourcetype is CIM-tagged into the Web datamodel with url, dest, src and user populated (accelerate it and drop summariesonly=false for speed). Exclude sandbox egress ranges. Treat any hit with stage=exploit_or_stealer_endpoint as a confirmed-exposure case: check device OS/browser version (iOS <=16.6.1, Chrome Android m121-m123), revoke sessions and rotate credentials. No OSINT corroboration exists for these IOCs (TL_OSINT_Scan); sourcing is Google TAG only.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- APT29 Mongolia Watering Hole — DNS Resolution of Attacker Domains (locked: unlock with TL Creds)
- ANDROSNATCH — Chrome Crash Report Deletion Following c.so Injection (locked: unlock with TL Creds)
- APT29 Stolen Cookie Replay — Sign-In From New IP After Exposure to Attacker Infrastructure (locked: unlock with TL Creds)
- APT29 VALIDVICTOR / COOKIESNATCH Beacon Endpoints — market-analytics.php, personalization_id, fb-connect.php (locked: unlock with TL Creds)
- APT29 Mobile Payload Hash Match — VALIDVICTOR, COOKIESNATCH, ANDROSNATCH, Chrome Recon (locked: unlock with TL Creds)
- APT29 Watering Hole Iframe Chain — Mongolian Government Site Referrer to Attacker Domain (locked: unlock with TL Creds)
- ANDROSNATCH — LD_PRELOAD Injection of [indicator] into Chrome (locked: unlock with TL Creds)
- APT29 COOKIESNATCH / ANDROSNATCH — HTTP POST Exfiltration to Attacker Domains (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- Domain: `track-adv[.]com`
- File hash: `8bd9a73da704b4d7314164bff71ca76c15742dcc343304def49b1e4543478d1a`
- Domain: `ceo-adviser[.]com`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [State-backed attackers and commercial surveillance vendors repeatedly use the same exploits (Google TAG)](https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/)
- [NVD - CVE-2023-41993](https://nvd.nist.gov/vuln/detail/CVE-2023-41993)
- [NVD - CVE-2024-5274](https://nvd.nist.gov/vuln/detail/CVE-2024-5274)
- [NVD - CVE-2024-4671](https://nvd.nist.gov/vuln/detail/CVE-2024-4671)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Russian APT29 hackers use iOS, Chrome exploits created by spyware vendors (BleepingComputer)](https://www.bleepingcomputer.com/news/security/russian-apt29-hackers-use-ios-chrome-exploits-created-by-spyware-vendors/)
- [APT29 watering-hole attacks use exploits from NSO Group and Intellexa (The Record)](https://therecord.media/mongolia-apt29-watering-hole-attacks-exploits-nso-group-intellexa)
- [APT29 utilizes exploits for Chrome and iOS made by spyware companies - Active IOCs (Rewterz)](https://rewterz.com/threat-advisory/apt29-utilizes-exploits-for-chrome-and-ios-made-by-spyware-companies-active-iocs)
- [APT29, NSO Group and Intellexa mobile exploits (Security Affairs)](https://securityaffairs.com/167797/apt/apt29-nso-group-and-intellexa-mobile-exploits.html)
- [Russia's APT29 using spyware exploits in new campaigns (TechTarget)](https://www.techtarget.com/cybersecurity/news/366609225/Russias-APT29-using-spyware-exploits-in-new-campaigns)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5340